6 Commits

Include renames

Author	SHA1	Message	Date
Shubham PampattiwarandGitHub	63fbf20cc5	Add readWriteOncePod backupPVC config to enable mount-level SELinux labeling (#10339) ... * Add readWriteOncePod backupPVC config to enable mount-level SELinux labeling On SELinux-enabled clusters the kubelet recursively relabels every file of the backupPVC at mount time, which can take hours on volumes with a high file count. Kubernetes avoids this when the volume is ReadWriteOncePod and the CSI driver advertises SELinux mount support, by mounting with -o context= instead. Add an opt-in per-storage-class 'readWriteOncePod' backupPVC config option that creates the backupPVC with the ReadWriteOncePod access mode and sets the backup pod's SecurityContext.SELinuxChangePolicy to MountOption. It is mutually exclusive with 'readOnly', which takes precedence. Fixes #9873 Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> * Add changelog file Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> * Do not set SELinuxChangePolicy for the backup pod Live testing on OCP 4.22 (k8s 1.35) showed that setting SecurityContext.SELinuxChangePolicy to MountOption makes backup pod creation fail outright when the SELinuxMount feature gate is disabled, which is the default on current clusters: Pod is invalid: spec.securityContext.seLinuxChangePolicy: Unsupported value: "MountOption": supported values: "Recursive" The field is also unnecessary. For ReadWriteOncePod volumes the kubelet already performs mount-level SELinux labeling via the SELinuxMountReadWriteOncePod feature gate, which has been on by default since k8s 1.28. Setting the backupPVC access mode to ReadWriteOncePod is sufficient on its own, and is portable to clusters where the broader SELinuxMount gate is still off. Verified on-cluster that the backupPVC is mounted with context="system_u:object_r:container_file_t:s0:c22,c28" instead of the recursive seclabel mount used without the flag. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> --------- Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>	2026-08-25 08:32:47 -07:00
Shubham Pampattiwar	1e1c9e2648	Document secretNames/configMapNames for backup/restore PVC config ... Document the new backupPVC/restorePVC secretNames and configMapNames options (velero#9920) that copy namespace-scoped secrets/configmaps to the Velero namespace so datamover can back up and restore encrypted CSI volumes (e.g. ODF/ceph-csi with Vault KMS). Updates the main and v1.18 docs. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>	2026-08-19 09:33:08 -07:00
3 people	0b7eaaf4e6	chore: replace vmware-tanzu/velero org references ... Agent-Logs-Url: https://github.com/velero-io/velero/sessions/e8c22e84-a488-4645-a0e1-aea5a2926503 Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com>	2026-05-22 07:38:02 +00:00
Xun Jiang	ffea850522	Add ephemeral storage limit and request support for data mover and maintenance job. ... Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-03-05 14:22:53 +08:00
Xun Jiang	e39374f335	Add maintenance job and data mover pod's labels and annotations setting. ... Add wait in file_system_test's async test cases. Add related documents. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2025-12-17 13:21:07 +08:00
Xun Jiang/Bruce JiangandGitHub	fdcfed84f9	Add the node-agent ConfigMap document. (#9434) ... Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2025-12-09 04:57:30 -05:00